@enter-pro/enter-cli 0.4.1 → 0.4.3

package/README.md

@@ -0,0 +1,167 @@
+# Enter CLI
+
+CLI for Enter projects, tasks and approval cards. Node 18+ is required.
+The [Enter Skill](skills/enter/SKILL.md) guides agents through the workflow;
+command options are available through `enter-cli <command> --help`.
+
+## Authentication and configuration
+
+`enter-cli login` uses `auth.converge.ai` and the API at
+`https://api.enter.pro/code/api` (not the web domain `enter.converge.ai`).
+Log in again if credentials came from the former `auth.enter.pro` tenant.
+OAuth and API-key login verify the new token against `/v1/users/info` before
+saving it; verification failure preserves existing credentials. Expired local
+OAuth credentials renew automatically. An already-sent renewal saves rotated
+credentials before honoring cancellation, so the next invocation can still log in.
+
+`ENTER_API_KEY` takes precedence over local credentials. `login` saves local
+credentials but cannot switch an injected identity. `logout` clears local
+credentials only and reports `logged_out: false, auth_source: environment` when
+that variable remains set. Switch host-managed authentication in the host, or
+unset the variable in your shell.
+
+`config get/set/list` supports `api_url`, `base_path`, and `output` (`json`, `yaml`,
+`table`). Environment overrides are `ENTER_API_URL`, `ENTER_BASE_PATH`, and
+`ENTER_OUTPUT`. Workspace IDs are explicit command arguments; the unused
+`default_workspace` setting is rejected and legacy entries are ignored.
+
+## Submit, observe and deliver
+
+```sh
+enter-cli --output json thread chat PROJECT_ID --file requirement.txt
+enter-cli --output json thread wait PROJECT_ID --task-id TASK_ID --timeout 10
+enter-cli --output json thread status PROJECT_ID --task-id TASK_ID
+enter-cli thread watch PROJECT_ID --task-id TASK_ID --timeout 60
+```
+
+`chat --stdin` also accepts multiline input. Submission returns immediately with
+`task_id`, `submission_status: accepted`, and continuation commands. Follow-ups
+can be submitted while Enter works; acceptance is not completion.
+
+| Command | Output and default lifetime |
+| --- | --- |
+| `status` | One JSON/YAML snapshot, 30-second deadline |
+| `wait` | One result on a card, terminal state or timeout; 10 seconds |
+| `watch` | Changed snapshots as NDJSON, then `type: result`; 60 seconds |
+
+Use one observer per task. In interactive agents, use the returned short wait,
+handle incoming user messages, then continue the same task. Normal observation
+timeout is not a reason to increase the wait or resubmit. Background watch is
+appropriate only with completion notifications and non-blocking output collection;
+do not immediately block on the job for minutes. CLI lifetime and host job-wait
+limits are separate upper bounds, not measured elapsed time. Hosts own message
+scheduling: CLI events cannot make a blocked host process new user input.
+
+`--task-id` follows exactly the submitted task, including queue time. `--turn N`
+selects a fixed turn instead; without either, observation pins the first turn.
+`--chat-id` scopes lookup and continuation. An interjection may return an external
+message ID that the backend cannot correlate to a turn: report `unknown`, inspect
+messages and the resulting change, and do not substitute the newest turn.
+
+| Status | Meaning |
+| --- | --- |
+| `idle` | No turn yet |
+| `queued` | Selected task is queued |
+| `unknown` | Missing turn, unavailable status or uncorrelated submission |
+| `running` | Nonterminal turn with no pending action |
+| `blocked` | Inspect `actions` for input or approval |
+| `completed` | Turn completed; build and deployment are separate |
+| `failed` | Turn failed, errored or was cancelled |
+
+`project create --wait` uses the same observer and requires a matching successful
+build. For existing tasks use `--require-build`; stale builds cannot satisfy it.
+`build_matches_turn` checks commit identity. `status/wait` retain full metadata;
+`--compact` selects monitoring fields. `watch` is compact unless `--full` is set.
+The additive `workflow` projection supplies `state`, `task`, `next_action`,
+`observation`, build matching and action descriptors; full card details remain in
+`actions`. `use_existing_authorization` does not grant new permission.
+
+Exit 0 means observation succeeded (including a blocked card), not build success.
+Exit 2 means a wait timed out with work pending; exit 1 means failure, unknown
+state or query failure. `query_timed_out` marks a query deadline; retained state
+is the last complete snapshot. SIGINT/SIGTERM returns `interrupted: true` and
+130/143 without cancelling remote work. A cancelled turn can still have a queued
+backend operation; do not confuse it with completed cancellation or restoration.
+
+Completed snapshots include `messages_command`. Use
+`thread messages PROJECT_ID --turn N --text` to read Enter's delivery and validation
+summary. Report build success, saved configuration and real-service validation
+separately; do not replace Enter's validation with source keyword scans.
+
+## Transport and errors
+
+Observation uses authenticated WebSocket events, reconnects with `last_event_id`,
+deduplicates replay, and re-reads authoritative HTTP state. Healthy streams have a
+30-second safety refresh; unavailable streams fall back to 2-second HTTP checks.
+Text/argument deltas do not trigger full queries; card persistence gets a short
+reconciliation window. `--transport poll` forces HTTP, `--cursor` resumes events,
+and `transport/transport_reason/cursor` identify progress. Stream 401/403 fails explicitly;
+unsupported endpoints fall back without repeated reconnects. WebSockets respect
+proxy variables and `NO_PROXY`; `NODE_USE_ENV_PROXY=0` disables their proxy use.
+
+`thread messages PROJECT_ID --follow --timeout 60 --cursor EVENT_ID` emits raw
+NDJSON events with diagnostics on stderr. It supports `--max-events`, crosses turn
+boundaries, and does not synthesize HTTP state when the socket is unavailable.
+
+`--request-timeout SECONDS` covers API requests and response bodies, including
+downloads. Monitoring always has its own deadline. `project publish --timeout`
+validates before requests and bounds lookup, submission, observation and URL
+verification. After uncertain publication, query `project publish-status` first.
+Only transient observation reads retry automatically; mutations never do.
+`error.outcome_unknown: true` means inspect actual state before retrying a write.
+
+JSON execution errors go to stderr; observation errors accompany the last
+snapshot on stdout. Error fields are `code/message/retryable/outcome_unknown`.
+Keep stdout and stderr separate. JSON/YAML confirmations are structured;
+interactive login instructions use stderr. Known credential fields and encoded
+tool arguments are redacted in monitoring, approval, events and verbose bodies;
+ordinary content is not arbitrarily rewritten.
+
+## Approval cards
+
+Feature cards call the actual enable endpoint and verify action state; subscription
+refusal or enable failure remains an error. Plans require user approval. Questions
+carry their original text, options and selection mode: use that text as the answer
+key, not a host question ID. `thread approve --help` describes `selected_options`
+and `other_text`; skip only when the user requests it.
+
+Configuration cards expose required fields. Reuse authorized input, ask only for
+missing values, and use stdin from a secure input or user-provided file, or Enter's
+form. OAuth configuration is saved before credential-free approval; after form
+submission, check status because the form may already have approved the action.
+Provider fields, Secret/Stripe inputs and examples are in
+[configuration guidance](skills/enter/references/configuration.md).
+Do not echo secrets or embed them in shell text/build prompts: stdin does not
+protect earlier chat or tool logs. User-approved placeholders remain pending
+integrations; mock configuration does not prove real OAuth login or payment.
+
+## Development and host installation
+
+```sh
+npm ci
+npm test
+npm run build
+npm pack
+npm run install:hosts -- --package /absolute/path/enter-pro-enter-cli-0.4.3.tgz
+```
+
+Tests use loopback HTTP/WebSocket fixtures and dummy credentials, not real cloud
+provisioning or host UI acceptance. The installer puts the same package and Skill
+into Codex/DSH, renders the wrapper, and records its SHA-256. `--host codex|dsh`
+selects one host; `--home` supports isolated installs. No checkout is needed at runtime.
+
+For manual simulation, run `npm run mock:serve`, then in another terminal:
+
+```sh
+npm run local:cli -- thread status cloud
+npm run local:cli -- thread approve cloud cloud-action
+npm run local:cli -- thread wait cloud --timeout 3
+```
+
+The server binds loopback port 43180 (`MOCK_ENTER_PORT` overrides it). The wrapper
+forces loopback and a dummy key even if production environment variables exist.
+Scenarios: `plan`, `cloud`, `ai`, `secret`, `questions`, `subscription`, `running`,
+`failed`, `http-error`, `stalled`. Card IDs are `<scenario>-action`. Restart to reset;
+unsupported routes fail, and request bodies/secrets are not retained. Only use
+fake values. `.env.integration.example` lists real-test variables; its ignored
+`.env.integration.local` counterpart is never loaded automatically.

package/dist/auth.d.ts

@@ -6,7 +6,11 @@ export interface Credentials {
     expires_at?: string;
 }
 export declare function saveCredentials(creds: Credentials): void;
+export declare function verifyAccessToken(token: string): Promise<void>;
 export declare function loadCredentials(): Credentials | null;
 export declare function clearCredentials(): void;
 export declare function getToken(): string;
 export declare function isAuthenticated(): boolean;
+export declare const OAUTH_TOKEN_URL = "https://auth.converge.ai/oauth/token";
+export declare const OAUTH_CLIENT_ID = "anCisSaaIA36fTZ2DUMiTMro3bYuptrf";
+export declare function getValidToken(signal?: AbortSignal): Promise<string>;

package/dist/auth.js

@@ -1,14 +1,42 @@
-import { readFileSync, writeFileSync, unlinkSync } from "fs";
+import { readFileSync, writeFileSync, unlinkSync, mkdirSync, renameSync, rmdirSync } from "fs";
+import { setTimeout as delay } from "node:timers/promises";
+import { randomUUID } from "node:crypto";
 import { join } from "path";
-import { configDir } from "./config.js";
+import { baseURL, configDir } from "./config.js";
 const CREDENTIALS_FILE = "credentials.json";
 function credentialsPath() {
     return join(configDir(), CREDENTIALS_FILE);
 }
 export function saveCredentials(creds) {
-    writeFileSync(credentialsPath(), JSON.stringify(creds, null, 2), {
-        mode: 0o600,
+    mkdirSync(configDir(), { recursive: true, mode: 0o700 });
+    const temporary = `${credentialsPath()}.${randomUUID()}.tmp`;
+    try {
+        writeFileSync(temporary, JSON.stringify(creds, null, 2), { mode: 0o600 });
+        renameSync(temporary, credentialsPath());
+    }
+    finally {
+        try {
+            unlinkSync(temporary);
+        }
+        catch { /* already renamed */ }
+    }
+}
+// Validate the newly issued token, not an older saved token or ENTER_API_KEY.
+// Do not persist it or claim login success until the configured API accepts it.
+export async function verifyAccessToken(token) {
+    if (!token)
+        throw new Error("Login did not return an access token");
+    const response = await fetch(`${baseURL()}/v1/users/info`, {
+        headers: { Authorization: `Bearer ${token}` },
+        signal: AbortSignal.timeout(15000),
     });
+    if (!response.ok) {
+        throw new Error(`Login verification failed (HTTP ${response.status}); credentials were not saved`);
+    }
+    const result = await response.json();
+    if (result?.code !== 0) {
+        throw new Error("Login verification failed: API did not confirm authentication; credentials were not saved");
+    }
 }
 export function loadCredentials() {
     try {
@@ -23,8 +51,9 @@ export function clearCredentials() {
     try {
         unlinkSync(credentialsPath());
     }
-    catch {
-        // ignore if file doesn't exist
+    catch (error) {
+        if (error.code !== "ENOENT")
+            throw error;
     }
 }
 export function getToken() {
@@ -37,3 +66,100 @@ export function getToken() {
 export function isAuthenticated() {
     return getToken() !== "";
 }
+// Same OAuth client as interactive login. Environment keys (including Work's
+// transparent placeholder) must never fall back to a personal OAuth identity.
+export const OAUTH_TOKEN_URL = "https://auth.converge.ai/oauth/token";
+export const OAUTH_CLIENT_ID = "anCisSaaIA36fTZ2DUMiTMro3bYuptrf";
+let refreshing;
+function needsRefresh(creds) {
+    return !!creds.expires_at && Date.parse(creds.expires_at) <= Date.now() + 60000;
+}
+async function refreshCredentials(signal) {
+    const lock = join(configDir(), "credentials-refresh.lock");
+    const deadline = Date.now() + 20000;
+    // Serialize separate CLI processes too: rotating refresh tokens are single use.
+    while (true) {
+        signal?.throwIfAborted();
+        try {
+            mkdirSync(lock, { mode: 0o700 });
+            break;
+        }
+        catch (error) {
+            if (error.code !== "EEXIST")
+                throw error;
+            if (Date.now() >= deadline)
+                throw new Error("Another CLI is refreshing login. Retry after it finishes; if it crashed, remove ~/.enter/credentials-refresh.lock.");
+            await delay(100, undefined, { signal });
+        }
+    }
+    try {
+        const creds = loadCredentials();
+        if (!creds?.access_token)
+            return "";
+        if (!needsRefresh(creds))
+            return creds.access_token;
+        if (!creds.refresh_token)
+            throw new Error("Login expired. Run `enter-cli login` to sign in again.");
+        let response;
+        try {
+            response = await fetch(OAUTH_TOKEN_URL, {
+                method: "POST",
+                headers: { "Content-Type": "application/json" },
+                body: JSON.stringify({ grant_type: "refresh_token", client_id: OAUTH_CLIENT_ID, refresh_token: creds.refresh_token }),
+                signal: AbortSignal.timeout(15000),
+            });
+        }
+        catch {
+            throw new Error("Could not refresh login. Check connectivity and retry; saved credentials were preserved.");
+        }
+        if (!response.ok) {
+            if ([400, 401, 403].includes(response.status))
+                throw new Error("Login renewal was rejected. Run `enter-cli login` to sign in again.");
+            throw new Error(`Login renewal failed (HTTP ${response.status}). Retry later.`);
+        }
+        let tokens;
+        try {
+            tokens = await response.json();
+        }
+        catch {
+            throw new Error("Login renewal returned an invalid response.");
+        }
+        if (typeof tokens?.access_token !== "string" || !tokens.access_token ||
+            typeof tokens.expires_in !== "number" || !Number.isFinite(tokens.expires_in) || tokens.expires_in <= 0 ||
+            (tokens.refresh_token !== undefined && (typeof tokens.refresh_token !== "string" || !tokens.refresh_token))) {
+            throw new Error("Login renewal returned an invalid response.");
+        }
+        // Persist rotation immediately; an API outage after renewal must not discard
+        // the new refresh token and strand the next invocation with the consumed one.
+        saveCredentials({
+            ...creds, access_token: tokens.access_token,
+            refresh_token: tokens.refresh_token ?? creds.refresh_token,
+            token_type: typeof tokens.token_type === "string" ? tokens.token_type : creds.token_type,
+            expires_at: new Date(Date.now() + tokens.expires_in * 1000).toISOString(),
+        });
+        return tokens.access_token;
+    }
+    finally {
+        rmdirSync(lock);
+    }
+}
+export async function getValidToken(signal) {
+    signal?.throwIfAborted();
+    if (process.env.ENTER_API_KEY)
+        return process.env.ENTER_API_KEY;
+    const creds = loadCredentials();
+    if (!creds?.access_token)
+        return "";
+    if (!needsRefresh(creds))
+        return creds.access_token;
+    // Cancelable callers use the same filesystem lock without canceling another
+    // caller's renewal. Once sent, renewal must finish and persist token rotation.
+    if (signal) {
+        const token = await refreshCredentials(signal);
+        signal.throwIfAborted();
+        return token;
+    }
+    if (!refreshing)
+        refreshing = refreshCredentials().finally(() => { refreshing = undefined; });
+    return refreshing;
+}

package/dist/client.d.ts

@@ -1,11 +1,9 @@
+export declare function setRequestTimeout(seconds: number): void;
 export declare function setVerbose(v: boolean): void;
-export declare function get(path: string, params?: Record<string, string>): Promise<unknown>;
-export declare function post(path: string, body?: unknown): Promise<unknown>;
+export declare function get(path: string, params?: Record<string, string>, signal?: AbortSignal): Promise<unknown>;
+export declare function post(path: string, body?: unknown, signal?: AbortSignal): Promise<unknown>;
 export declare function del(path: string): Promise<unknown>;
-export declare function put(path: string, body?: unknown): Promise<unknown>;
 export declare function patch(path: string, body?: unknown): Promise<unknown>;
 export declare function workGet(path: string, params?: Record<string, string>): Promise<unknown>;
 export declare function workPost(path: string, body?: unknown): Promise<unknown>;
-export declare function workPatch(path: string, body?: unknown): Promise<unknown>;
-export declare function workDel(path: string): Promise<unknown>;
-export declare function getRaw(path: string): Promise<Response>;
+export declare function getRaw(path: string): Promise<ArrayBuffer>;

package/dist/client.js

@@ -1,8 +1,16 @@
 import { baseURL, workURL } from "./config.js";
-import { getToken } from "./auth.js";
-import { APIError } from "./errors.js";
+import { getValidToken } from "./auth.js";
+import { safeOutput } from "./safe-output.js";
+import { APIError, RequestError } from "./errors.js";
+import { setTimeout as delay } from "node:timers/promises";
 const CODE_SUCCESS = 0;
 let verbose = false;
+let requestTimeoutMs;
+export function setRequestTimeout(seconds) {
+    if (!Number.isFinite(seconds) || seconds <= 0 || seconds > 2147483)
+        throw new Error("--request-timeout must be a positive number of seconds");
+    requestTimeoutMs = seconds * 1000;
+}
 export function setVerbose(v) {
     verbose = v;
 }
@@ -16,61 +24,111 @@ async function request(method, path, options, base) {
     const headers = {
         "Content-Type": "application/json",
     };
-    const token = getToken();
-    if (token)
-        headers["Authorization"] = `Bearer ${token}`;
-    const init = { method, headers };
+    const init = { method, headers, signal: options?.signal };
     if (options?.body !== undefined) {
         init.body = JSON.stringify(options.body);
     }
     if (verbose) {
         console.error(`> ${method} ${url}`);
         if (options?.body)
-            console.error(`> Body: ${JSON.stringify(options.body)}`);
-    }
-    const resp = await fetch(url, init);
-    if (verbose) {
-        console.error(`< ${resp.status} ${resp.statusText}`);
-    }
-    if (resp.status === 401) {
-        throw new Error("Authentication required. Run `enter login` or set ENTER_API_KEY environment variable.");
+            console.error(`> Body: ${JSON.stringify(safeOutput(options.body, { redactIdentifiers: true }))}`);
     }
-    const text = await resp.text();
-    let apiResp;
+    // A single deadline covers retries and reading the response body as well as
+    // connecting. Never replay writes after an ambiguous transport failure.
+    const readOnly = method === "GET" || (method === "POST" && path.endsWith("/thread/actions"));
+    const retryRead = readOnly && /\/thread\/(turns|actions|messages|tasks)$/.test(path);
+    const controller = new AbortController();
+    const abort = () => controller.abort(options?.signal?.reason);
+    options?.signal?.addEventListener("abort", abort, { once: true });
+    if (options?.signal?.aborted)
+        abort();
+    const timer = requestTimeoutMs === undefined ? undefined : setTimeout(() => controller.abort(), requestTimeoutMs);
+    init.signal = controller.signal;
     try {
-        apiResp = JSON.parse(text);
-    }
-    catch {
-        if (resp.status >= 400) {
-            throw new Error(`HTTP ${resp.status}: ${text}`);
+        const token = await getValidToken(controller.signal);
+        if (token)
+            headers["Authorization"] = `Bearer ${token}`;
+        for (let attempt = 0;; attempt++) {
+            let resp;
+            let text;
+            try {
+                resp = await fetch(url, init);
+                if (options?.raw && resp.ok && !resp.headers.get("content-type")?.includes("application/json")) {
+                    return await resp.arrayBuffer();
+                }
+                text = await resp.text();
+            }
+            catch (error) {
+                if (options?.signal?.aborted)
+                    throw error;
+                const timedOut = controller.signal.aborted;
+                const cause = error.cause?.code;
+                if (retryRead && !timedOut && attempt < 1) {
+                    await delay(200, undefined, { signal: controller.signal });
+                    continue;
+                }
+                throw new RequestError(timedOut ? "REQUEST_TIMEOUT" : "NETWORK_ERROR", timedOut ? "Enter request exceeded its deadline." : `Could not reach Enter${cause ? ` (${cause})` : ""}. Check connectivity and proxy settings.`, readOnly, !readOnly, cause);
+            }
+            if (verbose) {
+                console.error(`< ${resp.status} ${resp.statusText}`);
+            }
+            if (resp.status === 401) {
+                throw new Error("Authentication required. Run `enter-cli login` or set ENTER_API_KEY environment variable.");
+            }
+            if (retryRead && [502, 503, 504].includes(resp.status) && attempt < 1) {
+                await delay(200, undefined, { signal: controller.signal });
+                continue;
+            }
+            let apiResp;
+            try {
+                apiResp = JSON.parse(text);
+            }
+            catch {
+                if (resp.status >= 400) {
+                    throw new RequestError(`HTTP_${resp.status}`, `Enter returned HTTP ${resp.status}.`, readOnly && resp.status >= 500, !readOnly && resp.status >= 500);
+                }
+                throw new RequestError("INVALID_RESPONSE", "Enter returned a non-JSON response.", readOnly, !readOnly);
+            }
+            if (apiResp.code === undefined) {
+                // Endpoint returns raw JSON without the standard {code,message,data} envelope.
+                // Surface the parsed body as-is.
+                if (resp.status >= 400) {
+                    throw new RequestError(`HTTP_${resp.status}`, `Enter returned HTTP ${resp.status}.`, readOnly && resp.status >= 500, !readOnly && resp.status >= 500);
+                }
+                if (options?.raw)
+                    throw new RequestError("INVALID_RESPONSE", "Expected a binary download, but Enter returned JSON.", true);
+                return apiResp;
+            }
+            if (resp.status >= 500)
+                throw new RequestError(apiResp.code ? String(apiResp.code) : `HTTP_${resp.status}`, `Enter returned HTTP ${resp.status}${apiResp.message ? `: ${apiResp.message}` : ""}.`, readOnly, !readOnly);
+            if (apiResp.code !== CODE_SUCCESS) {
+                throw new APIError(apiResp.code, apiResp.message ?? "", apiResp.detail ?? "");
+            }
+            if (options?.raw)
+                throw new RequestError("INVALID_RESPONSE", "Expected a binary download, but Enter returned JSON.", true);
+            return apiResp.data;
         }
-        return JSON.parse(text);
     }
-    if (apiResp.code === undefined) {
-        // Endpoint returns raw JSON without the standard {code,message,data} envelope.
-        // Surface the parsed body as-is.
-        if (resp.status >= 400) {
-            throw new Error(`HTTP ${resp.status}: ${text}`);
+    catch (error) {
+        if (controller.signal.aborted && !options?.signal?.aborted) {
+            throw new RequestError("REQUEST_TIMEOUT", "Enter request exceeded its deadline.", readOnly, !readOnly);
         }
-        return apiResp;
+        throw error;
     }
-    if (apiResp.code !== CODE_SUCCESS) {
-        throw new APIError(apiResp.code, apiResp.message ?? "", apiResp.detail ?? "");
+    finally {
+        clearTimeout(timer);
+        options?.signal?.removeEventListener("abort", abort);
     }
-    return apiResp.data;
 }
-export async function get(path, params) {
-    return request("GET", path, { params });
+export async function get(path, params, signal) {
+    return request("GET", path, { params, signal });
 }
-export async function post(path, body) {
-    return request("POST", path, { body });
+export async function post(path, body, signal) {
+    return request("POST", path, { body, signal });
 }
 export async function del(path) {
     return request("DELETE", path);
 }
-export async function put(path, body) {
-    return request("PUT", path, { body });
-}
 export async function patch(path, body) {
     return request("PATCH", path, { body });
 }
@@ -81,60 +139,6 @@ export async function workGet(path, params) {
 export async function workPost(path, body) {
     return request("POST", path, { body }, workURL());
 }
-export async function workPatch(path, body) {
-    return request("PATCH", path, { body }, workURL());
-}
-export async function workDel(path) {
-    return request("DELETE", path, {}, workURL());
-}
 export async function getRaw(path) {
-    const url = `${baseURL()}${path}`;
-    const headers = {};
-    const token = getToken();
-    if (token)
-        headers["Authorization"] = `Bearer ${token}`;
-    if (verbose)
-        console.error(`> GET ${url}`);
-    const resp = await fetch(url, { headers });
-    if (verbose)
-        console.error(`< ${resp.status} ${resp.statusText}`);
-    if (resp.status === 401) {
-        throw new Error("Authentication required. Run `enter login` or set ENTER_API_KEY environment variable.");
-    }
-    // Successful binary response — caller consumes the body.
-    if (resp.ok) {
-        // But: a JSON error envelope can come back with status 200 too. Peek the
-        // content-type; only treat as raw if it's not JSON.
-        const ct = resp.headers.get("content-type") ?? "";
-        if (!ct.includes("application/json"))
-            return resp;
-        const text = await resp.text();
-        try {
-            const apiResp = JSON.parse(text);
-            if (apiResp.code !== 0) {
-                throw new APIError(apiResp.code, apiResp.message, apiResp.detail);
-            }
-            // code === 0 with JSON body on a binary endpoint shouldn't happen; surface as raw text
-            throw new Error(`Unexpected JSON response on binary endpoint: ${text.slice(0, 200)}`);
-        }
-        catch (err) {
-            if (err instanceof APIError)
-                throw err;
-            throw new Error(`Failed to parse JSON response: ${text.slice(0, 200)}`);
-        }
-    }
-    // Non-2xx — try to parse the API error envelope so callers can distinguish
-    // VIP_REQUIRED, NOT_FOUND, etc. Fall back to raw text if it isn't JSON.
-    const text = await resp.text();
-    try {
-        const apiResp = JSON.parse(text);
-        if (apiResp.code !== undefined) {
-            throw new APIError(apiResp.code, apiResp.message ?? "", apiResp.detail ?? "");
-        }
-    }
-    catch (err) {
-        if (err instanceof APIError)
-            throw err;
-    }
-    throw new Error(`HTTP ${resp.status}: ${text || resp.statusText}`);
+    return request("GET", path, { raw: true });
 }

package/dist/commands/config.js

@@ -1,25 +1,20 @@
 import { Command } from "commander";
 import { setConfig, getConfig, allSettings } from "../config.js";
-import { print, printMessage, printTable } from "../output.js";
+import { print, printResult, printTable, getFormat } from "../output.js";
 export const configCmd = new Command("config").description("Manage CLI configuration");
 configCmd
     .command("set <key> <value>")
     .description("Set a configuration value")
-    .action(async (key, value) => {
+    .action(async (key, value, _opts, cmd) => {
     setConfig(key, value);
-    printMessage(`Set ${key} = ${value}`);
+    printResult(getFormat(cmd), { key, value }, `Set ${key} = ${value}`);
 });
 configCmd
     .command("get <key>")
     .description("Get a configuration value")
-    .action(async (key) => {
+    .action(async (key, _opts, cmd) => {
     const val = getConfig(key);
-    if (!val) {
-        printMessage(`${key}: (not set)`);
-    }
-    else {
-        printMessage(`${key}: ${val}`);
-    }
+    printResult(getFormat(cmd), { key, value: val || null }, val ? `${key}: ${val}` : `${key}: (not set)`);
 });
 configCmd
     .command("list")

package/dist/commands/domain.js

@@ -1,10 +1,7 @@
 import { Command } from "commander";
 import * as client from "../client.js";
-import { print, printMessage, printTable } from "../output.js";
+import { print, printResult, printTable, getFormat } from "../output.js";
 export const domainCmd = new Command("domain").description("Manage project domains");
-function getFormat(cmd) {
-    return cmd.optsWithGlobals().output || "json";
-}
 domainCmd
     .command("list <project_id>")
     .description("List project domains")
@@ -37,9 +34,9 @@ domainCmd
     .command("remove <project_id>")
     .description("Remove a custom domain from project")
     .requiredOption("--domain <name>", "Domain name to remove")
-    .action(async (id, opts) => {
+    .action(async (id, opts, cmd) => {
     await client.del(`/v1/projects/${id}/domain?domain=${opts.domain}`);
-    printMessage(`Domain "${opts.domain}" removed.`);
+    printResult(getFormat(cmd), { removed: true, domain: opts.domain }, `Domain "${opts.domain}" removed.`);
 });
 domainCmd
     .command("refresh <project_id>")